A Site-to-Site VPN between your on-premises network and an Azure virtual network disconnects frequently. To troubleshoot the IPsec tunnel from the Azure side, which Azure VPN Gateway diagnostic log should you check?

The IKEDiagnosticLog (Internet Key Exchange Diagnostic Log) is the correct choice because frequent disconnections of an IPsec tunnel often indicate issues during the IKE phase, which is responsible for establishing and maintaining the security association. This log provides detailed information about IKE negotiations, including authentication failures, key exchange problems, and policy mismatches that can lead to tunnel instability. GatewayDiagnosticLog provides general gateway health but lacks the specific detail for IPsec tunnel issues. RouteDiagnosticLog focuses on routing problems, not tunnel establishment. TunnelDiagnosticLog provides information about the tunnel's operational state but may not pinpoint the root cause of IKE-related disconnections as effectively as the IKEDiagnosticLog.